Yahoo got hacked back at the end of last month. They said thousands of passwords had been stolen and recommended everyone change their password. Did you happen to use the same password for your Paypal that you do for your email account? If so that's a big no no. Also you should always delete any Paypal/bank/or any other important messages that come to your email if they have an account link in them. That way if someone does hack your email then they can't just log into your account through a link